Exploited Cisco email gateway flaw lets a crafted attachment run commands as root
Cisco patched CVE-2026-76519, an exploited Secure Email Gateway flaw that gives unauthenticated attackers root through a crafted email attachment. Devices with File Reputation enabled and Content Scanner Tools earlier than 25.3.0.5525 are affected.
The Watch · Security desk
Affected: File Reputation on a mail policy and Content Scanner Tools before 25.3.0.5525. Shadowserver tracks nearly 300 online, honeypots or secured unknown. Cisco urges log checks and contacted cloud owners with potential compromise. Third exploited zero-day since November 2025.
- Who's exposed exposure SEGs with File Reputation on Affected if File Reputation is on a mail policy and Content Scanner Tools is before 25.3.0.5525, claim 5
- Who's exposed exposure Gateways exposed online Shadowserver tracks nearly 300, not saying how many are honeypots or already secured, claim 15
- What it limits constraint Customers Cross-check firewall and network logs, as attackers may remove evidence after gaining root, claim 7
- Who has to decide decision Secure Email Cloud owners Contacted by Cisco where it found evidence of a potential compromise, claim 8
- What it sets up precedent Secure Email Gateway line Third actively exploited zero-day in the SEG/AsyncOS line since November 2025, claim 14
| Who | How | Kind | Claim |
|---|---|---|---|
| SEGs with File Reputation on | Affected if File Reputation is on a mail policy and Content Scanner Tools is before 25.3.0.5525 | exposure | 5 |
| Gateways exposed online | Shadowserver tracks nearly 300, not saying how many are honeypots or already secured | exposure | 15 |
| Customers | Cross-check firewall and network logs, as attackers may remove evidence after gaining root | constraint | 7 |
| Secure Email Cloud owners | Contacted by Cisco where it found evidence of a potential compromise | decision | 8 |
| Secure Email Gateway line | Third actively exploited zero-day in the SEG/AsyncOS line since November 2025 | precedent | 14 |
What happened
- The flaw is a relative path traversal in the Advanced Malware Protection feature, caused by improper handling of email attachments sent through an unpatched device.
- Cisco's PSIRT became aware of active exploitation in October 2026, according to the advisory Cisco published on a Wednesday.
- Cisco published indicators of compromise for the attacks but, per BleepingComputer, shared no further details about them.
- Cisco says it has deployed mitigations on cloud instances and contacted Secure Email Cloud owners where it found evidence of a potential compromise.
Why it matters
- Who's exposed exposure Shadowserver counts nearly 300 gateways exposed online, but the figure does not separate honeypots or secured devices, so it is not a count of vulnerable ones.
- Who has to decide decision A patched device still needs a log review, because Cisco warns that attackers may remove evidence of exploitation after gaining root.
- What it sets up precedent At least two of the three exploited zero-days since November 2025 reach root through email handling, so we'd expect further advisories of this kind for the product.
Next story · Security · yesterday
CISA gives agencies until October 17 to fix four exploited bugs in Cisco, Palo Alto and Ahsay productsConfirmed3 publishers
Exploitability is high on any device that meets Cisco's two conditions. The attacker needs no account [1], and the trigger is a message sent through the device [4]. Cisco's advisory states the outcome: "A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system." [2]
The conditions are File Reputation enabled and assigned to a mail policy, and Content Scanner Tools earlier than 25.3.0.5525 [5]. Admins read the version with the contentscannerstatus CLI command. They then check the "Enable File Reputation" checkbox under Mail Policies > Incoming Mail Policies > Advanced Malware Protection, or under Mail Policies > Outgoing Mail Policies > Advanced Malware Protection [10]. The affected range ends below 25.3.0.5525, so a device on that build or a later one is outside it [11].
Cisco's hunting guidance is to cross-check firewall and network logs for suspicious activity, including downloads and uploads to and from external or suspicious IP addresses [7]. For customers it contacted, the advice is to restore the device. Cisco said: "Cisco strongly recommends that customers who have been contacted restore a device to a secure configuration by renewing credentials and any cryptographic materials that are installed on the appliance, when possible." [9]
The product line has a history. In January Cisco patched CVE-2025-20393, a maximum-severity AsyncOS flaw that attackers have exploited in zero-day attacks on Secure Email Gateway and Secure Email and Web Manager appliances since November 2025 [12]. Last month, BleepingComputer reports, Cisco warned of CVE-2026-76461, an email-parsing flaw in AsyncOS that also lets unauthenticated remote attackers run commands as root [13]. CVE-2026-76519 is the third exploited zero-day in the line since November 2025 [14]. The report does not tie the three to one actor, so a single campaign is not established.
What to watch
- Whether Cisco discloses who is exploiting CVE-2026-76519 and when exploitation began.
- Whether CISA adds CVE-2026-76519 to its catalog of actively exploited vulnerabilities.
- Whether Shadowserver's count of exposed Secure Email Gateway instances falls after the patch.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence82
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence78
Perspective Coverage
5 publishers- Builder
- Builder 13%
- Operator
- Operator 76%
- Investor
- Investor 11%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Cisco patched CVE-2026-76519, an actively exploited zero-day in its Secure Email Gateway that lets remote unauthenticated attackers execute commands with root privileges.
- [2]
Cisco said in a Wednesday advisory: "A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system."
- [3]
Cisco said in the Wednesday advisory that in October 2026 the Cisco PSIRT became aware of active exploitation of this vulnerability.
- [4]
CVE-2026-76519 stems from a relative path traversal weakness in SEG's Advanced Malware Protection feature, caused by improper handling of email attachments; attackers exploit it by sending an email with a maliciously crafted attachment through an unpatched device.
- [5]
CVE-2026-76519 affects SEG instances where the File Reputation service is enabled and assigned to a mail policy, and the Content Scanner Tools version is earlier than 25.3.0.5525.
- [6]
Cisco did not share further details about attacks exploiting CVE-2026-76519 but shared indicators of compromise.
- [7]
Cisco warned customers to cross-check firewall and network logs for signs of suspicious activity, including downloads and uploads to and from external or suspicious IP addresses, because attackers may remove evidence of exploitation after gaining root-level command execution.
- [8]
Cisco has already deployed mitigations on cloud instances and contacted Cisco Secure Email Cloud device owners where it found evidence of a potential compromise.
- [9]
Cisco said: "Cisco strongly recommends that customers who have been contacted restore a device to a secure configuration by renewing credentials and any cryptographic materials that are installed on the appliance, when possible."
- [10]
Admins check the Content Scanner Tools version with the contentscannerstatus CLI command and inspect the "Enable File Reputation" checkbox under Mail Policies > Incoming Mail Policies > Advanced Malware Protection or Mail Policies > Outgoing Mail Policies > Advanced Malware Protection in the web-based management interface.
- [11]
A device running Content Scanner Tools 25.3.0.5525 or later is outside the stated affected range.
- [12]
In January, Cisco patched a maximum-severity AsyncOS flaw, CVE-2025-20393, that attackers have exploited in zero-day attacks targeting SEG and Secure Email and Web Manager appliances since November 2025.
- [13]
Last month, Cisco warned customers to patch CVE-2026-76461, an actively exploited SEG zero-day in the email parsing of Cisco AsyncOS Software that lets unauthenticated, remote attackers execute arbitrary commands with root privileges on the underlying OS.
- [14]
CVE-2026-76519 is the third actively exploited zero-day in the Secure Email Gateway/AsyncOS line since November 2025.
- [15]
Shadowserver tracks nearly 300 Cisco Secure Email Gateway instances exposed online, but provides no information on how many are honeypots or have already been secured.
Sources
5 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comCisco patches new Secure Email Gateway zero-day exploited in attacks
1 article · October 14, 2026
- scworld.comCisco warns critical Secure Email Gateway bug exploited in the wild
1 article · October 15, 2026
- securityaffairs.comCisco Urges Customers to Patch Email Gateway Flaw and Check for Compromise
1 article · October 15, 2026
- securityweek.comCisco Warns of Exploited Secure Email Gateway Vulnerability
1 article · October 14, 2026
- thehackernews.comCisco Warns of Active Attacks Exploiting New Critical Secure Email Gateway Vulnerability
1 article · October 14, 2026
Topics and entities
Topics
- Email Security
- Network edge appliances
- Zero-Day Exploitation
- Vulnerability Management